Software used to count Australian Senate votes is a “trade secret”

http://easycount.mjec.net/

by mlandauer • 12 years ago

341 99 12 years ago

easycount.mjec.net

quink4• 12 years ago

http://www.zdnet.com/au/senate-calls-for-release-of-aec-vote...

http://www.brisbanetimes.com.au/it-pro/government-it/vexatio...

mjec4• 12 years ago

The Electoral Commission has since refused to comply with the Senate order to release the source code: http://lee-rhiannon.greensmps.org.au/sites/default/files/ron...

harkyns_castle3• 12 years ago

"I am advised that publication of the software could leave the voting system open to hacking or manipulation".

Well, if the problems are there, opening up the source to more eyes strikes me as the obvious thing to do; or should those with the knowledge of how to manipulate it as it stands be kept to the bare minimum? :)

But in any case, at least the meat of the implementation of the algorithm should be OK to release I would've thought - surely that isn't someone's intellectual property?

This is software we paid for and strikes me as pretty important to the democratic process, I'd like to have a bit of a look at it.

quink4• 12 years ago

Hi mjec, thanks.

I didn't know about this latest turn of events! This quote in particular is extremely disturbing... I noticed it in the FOI rejection, but now they're telling this to the Senate:

In relation to the source code for the Senate counting system, I am advised that publication of the software could leave the voting system open to hacking or manipulation.

This was after the Senate asking, this argument has nothing to do even with the FOI request.

And a previous thread on reddit: http://www.reddit.com/r/australia/comments/29t2q7/aec_threat...

zmmmmm3• 12 years ago

I'm only replying to say a personal thank you for pursuing this. Australia has such weak individual rights, it is so important that people like yourself put your hand to pursue them on occasions like this when it is important. Keep going!

cottsak• 12 years ago

@mjec,

"I am advised that publication of the software could leave the voting system open to hacking or manipulation"

Shouldn't this "advice" demand substantiation or evidence? Surely it's not enough for one to just get "advice" right? If so then any Joe could lie to this officer and they could write the same thing.

Also, what does that bit about "commercial-in-confidence" mean?

josephg• 12 years ago

Thats appalling.

As an Australian citizen, who should I call about this to voice my objection?

cheald• 12 years ago

That's a trade secret.

bobbles• 12 years ago

The process is proceeding as it should regardless. Anyone is able to put in a GIPA request, and they are allowed to refuse the information. As stated in the post an appeal of that decision is underway.

We need to start caring if the appeal is also refused.

Edit: GIPA is the NSW equivalent: http://www.ipc.nsw.gov.au/privacy/gipa_act.html

robzyb• 12 years ago

As a fellow Australian citizen, I would also like to know this.

mjec4• 12 years ago

Write to your Senator, say the AEC's refusal to comply[1] with Senate Order 330[2] is wrong and you'd like it challenged.

(Note that while it was moved by a Greens Senator, I'm not affiliated with the Greens and this is not a party political thing that's going on)

Failing that, maybe consider donating to my fund to fight this decision in court: http://pozi.be/easycountaat?ra=247325

[1] http://lee-rhiannon.greensmps.org.au/sites/default/files/ron...

[2] http://lee-rhiannon.greensmps.org.au/content/news-stories/up...

quink4• 12 years ago

You have a set of questions for this Abbott-led government regarding technology backed up by legitimate concerns?

Save your time, I already know the response to that.

It's 'Get Fucked'. And that was before the election.

http://delimiter.com.au/2013/08/07/get-fucked-turnbull-staff...

girvo• 12 years ago

The AEC is supposed to be non-partisan, and not have much to do with the parties themselves, IIRC (although they do report to the government at the end of the day).

Your point is well taken though. I'm thoroughly disgusted with the fear-mongering, technophobic way our government has conducted itself.

If you're interested in applying your technical skills to furthering the democratic process in Australia, volunteer with the Open Australia Foundation (which is what I'm doing). They've got everything on GitHub, and accept PRs!

https://www.openaustraliafoundation.org.au/

dwd3• 12 years ago

Try your local member. My local electorate is Fairfax so a bit of a no brainer.

Edit: Before anyone points out Clive's not in the Senate, he does have a very vocal, ongoing feud against the AEC and the budget for the AEC would most likely originate in the lower house.

sjwright• 12 years ago

My local electorate is Fairfax

I'm sorry.

colmmacc6• 12 years ago

Visibility of the source code is a side-show in electronic voting systems. Even if the source code is published, there is no way to be sure that that is the code that is running on the hardware, or to be certain that the hardware itself has not been tampered with. Votes need to be printed out on paper, verified by the voter, and counted by hand.

Still, when we had the source code for the Irish system (now abandoned due to our efforts) analyzed by a commission, it was found it had actual counting errors.

http://www.stdlib.net/~colmmacc/www.cev.ie/htm/report/part4_...

Amazing!

mlandauer5• 12 years ago

The Australian software is not used for recording votes. It's used to assist the counting of physical ballot papers because the Senate vote counting system is extremely complicated. In this environment it's more straightforward to ensure the integrity of the software (as long as it's open and verifiable of course)

colmmacc6• 12 years ago

In that case a simpler fix would be to allow any independent party (within reason) to supply and use their own software and render their own tally.

If the parties are mutually distrusting, and their tallies still agree, that can be enough to trust the outcome. Auditing the source code has no real utility; it's worthless because you can't be sure that the code you've audited is the code actually running. "Open and verifiable" means nothing in that context.

retroencabulato3• 12 years ago

Australian elections ARE pen and paper.

The ballots are entered (by hand AFAIK) into the AEC's central system to compute the complex preference flows. Realistically, the algorithm isn't that complicated, and the ABC does a good job at guestimating it [1]. This is why it is so surprising they refuse to release it, even after the Senate passed a motion demanding its release [2].

[1] http://www.abc.net.au/news/federal-election-2013/results/sen...

[2] http://www.computerworld.com.au/article/550114/electoral_com...

vacri2• 12 years ago

At Ruxcon last year there was a very interesting talk by an electoral systems researcher (I can't recall her name). She went through a number of electronic voting systems, and they all suck. Some more than others. The only case where she found a system that was close to acceptable was in a crypto organisation where everyone was highly technically fluent in the system. Certainly not transferable to the general public. She also noted that computerised systems tend to favour right-wing policies even if the algorithm is fair - people who vote for leftist policies are over-represented amongst migrants, people with disabilities, and other non-mainstream demographics.

She did have the opinion though that there was as place for electronic machines in the voting booth, and it was this: register your vote on a machine. It prints out a slip with clear, unambiguous markings against your selected candidate(s). Verify that it has the content you want, then go lodge the slip like any other paper ballot. You now have a clearer, less ambiguous version of the paper ballot, which is more accessible to people with certain kinds of disabilities to boot.

Most of the times that a paper ballot recount differs is not because of inept counters, but because some voters leave ambiguous marks. She said that in Australia, it has about the best system possible (edit: probably 'in current use') in terms of verifying the count: an AEC official does the counting, and the major parties volunteer scrutineers to challenge ambiguous voting slips. As there are mutually opposing witnesses, you get a fairly robust count - the differences come when one set of scrutineers allows one ambiguous mark, but on a recount that same ambiguous mark gets treated differently by another set of scrutineers.

The important thing is the pile of paper though - the evidence that people voted a certain way. In effect, as soon as you don't have the physical evidence, you're at the mercy of "trust us, it's accurate". How do you scrutinise that?

zmmmmm3• 12 years ago

It's not a side show at all, it's the most important thing. By showing us the code the AEC is making the implicit commitment that this is the code running on their systems. Until they show us some code they are not even making that commitment at all - they could be running anything, they could change it every day to match their whims.

My own suspicion is that they DO know of numerous problems either current or past and quite likely these will cast enough doubt on some particular past results that it would bring about a constitutional crisis.

colmmacc6• 12 years ago

I don't mean any offense - but your position is not self-consistent. "Showing us the code" does not invalidate "could change it every day to match their whims".

For example the entire source code to Linux is public, but looking from the outside, you as an observer have no way to know that a particular copy of the Linux code is what is running on my laptop.

Which is why I say it's a side-show. If the source code is shabby, getting it might help a little in the short-term; it makes the whole process less reputable. But code can be rewritten. It distracts from the real need; independent verification of the process itself.

retroencabulato3• 12 years ago

Or, as they said, the software has commercial value:

http://www.aec.gov.au/about_aec/AEC_Services/Fee_for_service...

Maxious4• 12 years ago

The Australian counting system is VB6 on embedded MSSQL upgraded from a COBOL implementation.

"Two AEC data entry operators enter the same ballot data into the system separately, so their counts can be compared to verify that data entry discrepancies are not allowed to influence the final outcome." http://www.itnews.com.au/News/360504,the-tech-behind-was-sen...

aianus3• 12 years ago

counted by hand.

By whom? Overseen by whom? Who oversees the overseers? Not to mention people make mistakes, ballots get dumped, and nobody has any evidence their vote was actually counted.

Here's a long but fascinating tech talk on a real solution:

https://www.youtube.com/watch?v=ZDnShu5V99s

colmmacc6• 12 years ago

I can talk about Ireland, as I've been an election observer there. The way we do it is that ballot boxes are locked and sealed with tamper-evident seals after a polling station has closed. Elections observers; including representatives from the political parties may request to add their own seals. In some particularly contentious districts this is done, but for the most part people are happy with the official seals.

The ballot boxes are then transported by the police force to the nearest "count center". The next morning, the seals are inspected and those ballot boxes are opened. All of the ballot boxes in a constituency are counted together in a secure, but open area. Here's a flickr set with a good number of photos showing how it's done:

https://www.flickr.com/photos/redmum/sets/72157600270850764

the counters are within the fenced area, and the observers - including many people from the political parties, surround the fence. The entire process is easy to see.

One particularly important part is what happens when the boxes are opened. The contents are just dumped out on the table and one by one each vote is turned to face up and towards the observers. The observers then "tally" the votes and mark which candidate (or referendum choice) the voter marked as their first preference.

All parties participate in this tally and it provides the first take on what the result will be. The margin of error on the tally is < 1%. Some tallies with enough tally-takers also count the 2nd and 3rd preferences, but most tallies just project the transfers (we use a transfer based voting system) and that too is generally accurate.

Contentious votes with identifying or ambiguous marks and so on are kept aside and argued over by people like me for an hour or so, but they never make much of a difference.

The end result is a process is very verifiable and auditable, in easy-to-understand human ways; you can literally show up at a count center and count the votes yourself as they come out of the boxes, and make sure that you're not being duped. That's a nice accessibility property too.

vacri2• 12 years ago

In Australia, they're counted by an government official, and overseen by mutually hostile volunteers (scrutineers) supplied from the major parties. It's boring to be a scrutineer, but it's in the major party interests to ensure they are sent.

sergiotapia• 12 years ago

A counting algorithm is a trade secret? How did this even come to be?

mlandauer5• 12 years ago

The algorithm is public. It's the Australian Electoral Commission's implementation of it, their software, that's used in public elections that they're calling a trade secret.

mjec4• 12 years ago

The algorithm is public

Clearly so -- except the AEC explicitly say "The algorithm is the trade secret."[1] Which to me says they don't know what algorithm means.

[1] http://easycount.mjec.net/2013-12-09-aec-to-mjec.pdf at paragraph 57.

retroencabulato3• 12 years ago

In their defence, in Section 15 of the FOI rejection letter, they mention the software is used for several fee-for-service industrial elections.

Tloewald3• 12 years ago

I've always though the Hare Clark system is intrinsically I democratic (even though it produces reasonable results) because no one seems to understand it (certainly the people who claim to can't explain it). It's also non deterministic -- the outcome can change hassle on the order in which votes are counted (although the impact will be very small in all probability)

jcrawfordor• 12 years ago

http://en.wikipedia.org/wiki/Single_transferable_vote#Counti...

sgryphon3• 12 years ago

STV used in Australia is deterministic. It does not change depending on the order in which votes are counted.

Tloewald3• 12 years ago

You don't understand the system. Surplus votes are distributed based on preferences, so order does matter because preferences will be different from one ballot to the next. Which ballots fill a candidate's quota determines which preferences don't get assigned.

axman6• 12 years ago

How can the order in which votes are counted change the outcome?

The whole process is in my opinion pretty easy to understand: each ballot is assigned to the candidate who is marked as the top preference and each candidates votes are counted. the candidate with the fewest votes has their ballows reassigned based on their next preference. This process continues until there are only enough candidates left to fill the number of seats. I can't see how this is nondeterministic (but would like to know it could be).

Khaine• 12 years ago

As someone who has lived and voted in a system that uses hare clark, let me say that it is a horrible system, and should never ever be used!

thrush• 12 years ago

Professor Alex Halderman from Michigan has performed a few studies on Electronic Voting and Electronic Voting Machines, and essentially has proven that it is insecure. At one point, he hacked an American EVM to play the Michigan Fight song on every submission. You can read a few of his papers here: [1][2]

The challenge of creating anonymous and secure voting systems is still an area of constant research, and I do not believe that the Australian gov't has solved these problems yet.

Should we view the source? If we know it's insecure because it's basically unbelievable to think that otherwise, what good will seeing the code do? The fact that it is not being shown basically confirms the insecurity (if it was truly secure, we'd be able to see it without having a negative effect on the system). It seems the right thing to do is to fight this method of voting until EVMs are more secure, but maybe we should hedge our bets. Maybe we're going to be stuck with these EVMs in the interim, and we should avoid leaking the source to prevent people who have difficulty viewing the source.

[1] https://jhalderm.com/pub/papers/evm-ccs10.pdf [2] https://jhalderm.com/pub/papers/voting-wecsr11.pdf

colmmacc6• 12 years ago

The Dutch group "We don't trust voting computers" [1] hacked up a machine to play chess [2]. It could easily beat a novice.

[1] http://wijvertrouwenstemcomputersniet.nl/English [2] https://www.flickr.com/photos/colmmacc/sets/7215759431270116...

Unit327• 12 years ago

Australia doesn't use EVMs, all voting is done on pen and paper and counted manually. This is just the software used to input those results, tally them, do preference flows, and declare the outcome.

3rg0s4m• 12 years ago

The algorithm used is fairly complicated, being both preferential and proportional. (The lower house is preferential but not proportional).

Here is a nifty visualization of the senate vote flows in NSW: http://www.grwpub.info/senate/nsw.svg.

Essentially you need a certain number of votes to cross the line and win a seat. After winning the seat, those votes are subtracted from the party. Eventually when no parties have enough votes, the lowest voted party is eliminated and its votes are redistributed by preference.

timv• 12 years ago

I once attempted to implement the Senate counting algorithm (mostly so I could force myself to truly understand it).

I can say with great confidence that it is hard to implement correctly, and it would take more than a single external audit to give me confidence that the AEC's implementation is flawless.

nmrm• 12 years ago

What's up with the yellow lines going from already-excluded parties?

sgryphon3• 12 years ago

As suggested, releasing the raw data as input would be better than the source code anyway. The raw data should not have any 'trade secret' or 'hack vulnerability'.

Vote for it on data.gov.au https://datagovau.ideascale.com/a/dtd/AEC-Raw-voting-data/42...

pwc• 12 years ago

You can download the 2013 Senate below-the-line preferences from here:

http://results.aec.gov.au/17496/Website/SenateDownloadsMenu-...

(Down the bottom, under “State Below the Line Preferences”)

I think those files, plus the above-the-line preferences should be enough to re-do the AEC's calculation... I would be interested to know if anyone had ever tried that.

Maxious4• 12 years ago

http://blog.angrygoats.net/2014/01/25/counting-the-west-aust... uses those files I think and is cited in the FOI review as an example of how someone could reproduce their "trade-secret" algorithm using publically available information.

DigitalSea• 12 years ago

If releasing the code is an issue, how about a compromise instead? How about releasing the code to a handful of independent third party firms and academics to determine for themselves if the code is safe. Does the AEC have an audit process in place where the code is checked and is there a testing environment of which the code is strongly tested for issues?

Given the undeniable complexity of such an algorithm, it would take more than a single audit to verify that it is secure. I don't doubt there is something up in the process somewhere, when it comes to vote redistribution I believe if not done correctly and properly tested, there could be some issues in that part alone.

Or better yet, release the data and allow academics from multiple institutions to independently run their own counts and then see if the results match up with that of the AEC's. I think that could be another way without releasing the code and verifying the results are accurate.

cmrn• 12 years ago

A review of the EasyCount software is currently out for limited tender: https://www.tenders.gov.au/?event=public.cn.view&CNUUID=53E3...

However that's still a far cry from any real scrutiny and transparency…

mlandauer5• 12 years ago

If you want to help solve this please contribute to @mjec's campaign to raise money for representation by a barrister at the AAT appeal http://www.pozible.com/project/183015

EGreg• 12 years ago

I propose someone sponsors a bill whereby any voting software used to count votes by the public must be open sourced and have several signatures (md5, sha1, etc.) which each voting center must verify before deploying it.

The voting centers would just have generic computers (perhaps with special peripherals for voting) which would load the software from a file and they could verify the signature of the file. There could be software that does this automatically. Such as the Apple app store.

That way, if any data centers detect an anomalous signature, they'd report it and it would raise a stink.

This is similar to the Apple App store except instead of Apple owning the ecosystem it would be their government. There are even better ways without all this crap -- either use an existing App Store from Google or Apple (or all) or have a browser extension and distributed app store from a distributed social app platform ;-)

doctorKrieger2• 12 years ago

how hard is to add numbers?

GhotiFish2• 12 years ago

Imagine if the principa mathmatica was decided upon by democracy.

That hard.

doctorKrieger2• 12 years ago

still i cannot comprehend that, the software simply has to measure the number of votes...

josephschmoe• 12 years ago

Honestly, the only way to prevent election rigging is to associate each vote with a key, make the key-vote-district database public and give each voter a copy of their vote keys.

If each vote is verifiable to the voter and the whole database is public, then we can have independent analysis done on the votes and no vote rigging is possible, except for creating additional fake keys.

And we can fix that problem simply by making the keys associated with a voter registration, which requires an ID. Same way we do now. Granted, that's still limited by the issues with paper ballots.

Software used to count Australian Senate votes is a “trade secret”

Related Stories